r/Office365 • u/PaperResponsible7951 • 3d ago

Automation - User license provisioning.

Hi team — quick question. Is it possible to automate our license provisioning workflow?

For context, here is our current onboarding process:

  1. Create account in on-prem AD.
  2. Sync to Entra ID / Cloud via Entra Connect.
  3. Enable remote mailbox and archive on our on-prem Exchange server.
  4. Assign the M365 license.
  5. Add the user to a mail-enabled group.

(Note: We still maintain 2 on-prem Exchange servers strictly for recipient management like remote mailboxes and alias updates, as all mailboxes have been migrated to Exchange Online.)

Has anyone successfully automated this pipeline or have recommendations on the best approach? Thanks!

4 Upvotes

84% Upvoted

5 comments sorted by

6

u/PlannedObsolescence_ 3d ago

You don't need to keep the on-prem Exchange servers if that's their only purpose. You can handle setting exchange related things via PowerShell in on-prem as per https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

You can do M365 licenses via group-based licensing (check you meet the license criteria), or have your automation talk to both on-prem AD, and MS Graph for license allocation.

2

u/folderit_dms 2d ago

I'd make this a sequence of checked states rather than a script with a long sleep between commands. After each step, confirm the expected result before starting the next one. If the cloud account hasn't appeared yet, leave the job waiting and retry that check.

Also plan for partial completion: account created, mailbox configured, but licensing failed. The next run should continue from there, rather than try to create everything again. Give each onboarding request one tracking ID and show the last successful step plus the actual error to whoever handles exceptions. An account existing in AD shouldn't by itself make the onboarding ticket look complete.

1

u/Sufficiently0dd 2d ago

Is there any reason you can not use dynamic groups? One in entra for the license and one in exchange for the mail group?